Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
We track 1,371 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.9. 18 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Exposure of Sensitive Information to an Unauthorized Actor vulnerabilities
- 7.5 High severity
Sophos Firewall: Insufficiently Protected Credentials
A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.
- 7.5 High severity
WebLogic Server: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3,
- 7.5 High severity
HTTP Server: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compro
- 7.5 High severity
Apache Traffic Server: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fi
- 7.5 High severity
discourse: Exposure of Sensitive Information to an Unauthorized Actor
Discourse is an open source platform for community discussion. New chat messages can be read by making an unauthenticated POST request to MessageBus. This issue is patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. Users are advised to upgrade.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
HarmonyOS: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affect service confidentiality.
- 8.1 High severity
urllib3: Exposure of Sensitive Information to an Unauthorized Actor
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Co
- 7.5 High severity
odh-dashboard: Cleartext Transmission of Sensitive Information
A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output inst
- 7.5 High severity
Red Hat build of Quarkus 2.13.8.Final: Exposure of Sensitive Information to an Unauthorized Actor
A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token
- 7.5 High severity
Disconnected Log Collector: Exposure of Sensitive Information to an Unauthorized Actor
IBM Disconnected Log Collector 1.0 through 1.8.2 is vulnerable to potential security misconfigurations that could disclose unintended information. IBM X-Force ID: 224648.
- 7.5 High severity
IBERMATICA RPS 2019: Insertion of Sensitive Information into Log File
Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as usernames, IP addresses or SQL queries sent to the application. By accessing the URL /RPS2019Service/st
- 7.5 High severity
Netman-204: Cleartext Transmission of Sensitive Information
All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials.
- 7.5 High severity
Core: Exposure of Sensitive Information to an Unauthorized Actor
In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sit
- 8.2 High severity
jumpserver: Exposure of Sensitive Information to an Unauthorized Actor
JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are
- 7.5 High severity
Product Catalog (csv, Excel) Import: Exposure of Sensitive Information to an Unauthorized Actor
MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclosure vulnerability via send.php.
- 7.5 High severity
ekorCCP: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server.
- 9.1 Critical severity
SQLpage: Exposure of Sensitive Information to an Unauthorized Actor
SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the `sqlpage/sqlpage.json` configuration file (not in an environment variable), wit
- 7.5 High severity
Tdsql Chitu: Exposure of Sensitive Information to an Unauthorized Actor
An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function in install.php.
- 7.5 High severity
terastation_nas_ts5410r: Exposure of Sensitive Information to an Unauthorized Actor
An Issue in Buffalo America, Inc. TeraStation NAS TS5410R v.5.00 thru v.0.07 allows a remote attacker to obtain sensitive information via the guest account function.
- 9.6 Critical severity
argo-cd: Insertion of Sensitive Information into Log File
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pu
- 7.7 High severity
AccessControl: Exposure of Sensitive Information to an Unauthorized Actor
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those at
- 7.5 High severity
PlayTube: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The identifier VDB-
- 7.5 High severity
Acronis Agent: Exposure of Sensitive Information to an Unauthorized Actor
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 32047, Acronis Cyber Protect 15 (Windows) before build 35979.
- 7.5 High severity
Mivoice Connect: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker
- 7.5 High severity
CP-VNR-3104, CP-VNR-3108, CP-VNR-3208: Exposure of Sensitive Information to an Unauthorized Actor
The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulne
- 8.1 High severity
Apache Airflow: Exposure of Sensitive Information to an Unauthorized Actor
Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connect
- 7.5 High severity
AK-SM800A: Improper Authentication
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information.
- 7.5 High severity
BUTTERFLY BUTTON: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (Architecture flaw) allows loss of plausible deniability and confidentiality.This issue affects BUTTERFLY BUTTON: As of 2023-08-21.
- 7.8 High severity
PowerScale OneFS: Exposure of Sensitive Information to an Unauthorized Actor
Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability. An authorized local attacker could potentially exploit this vulnerability, leading to escalation of privileges.
- 7.5 High severity
yaklang: Exposure of Sensitive Information to an Unauthorized Actor
yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web applicat
- 7.5 High severity
HarmonyOS: Improper Verification of Cryptographic Signature
Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiResources to be maliciously modified and overwritten.
- 7.5 High severity
HarmonyOS: Exposure of Resource to Wrong Sphere
Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromise apps' data security.
- 7.5 High severity
Avalanche: Exposure of Sensitive Information to an Unauthorized Actor
A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authentication bypass. Fixed in version 6.4.1.
- 7.5 High severity
Adlisting: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to lau
- 8.8 High severity
Apache Airflow: Exposure of Sensitive Information to an Unauthorized Actor
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It
- 7.5 High severity
metersphere: Missing Authorization
MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for
- 7.5 High severity
WP Ultimate CSV Importer – Import CSV, XML &…: Exposure of Sensitive Information to an Unauthorized Actor
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Sensitive Information Exposure via Directory Listing due to missing restriction in export folder indexing in versions up to, and including, 7.9.8. This makes it possible for unauthenticated att
- 7.5 High severity
strapi: Exposure of Sensitive Information to an Unauthorized Actor
Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix
- 7.1 High severity
strapi: Exposure of Sensitive Information to an Unauthorized Actor
Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types